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1 The above-entitled matter came on for hearing on Tuesday, July 13, 

2 2010, commencing at 9:50 a.m., at the U.S. Patent and Trademark Office, 

3 600 Dulany Street, Alexandria, Virginia, before Paula Lowery, Notary 

4 Public. 

5 THE CLERK: Good morning. Calendar Number 6 Appeal No. 2009- 

6 012764, Mr. Sokol. 

7 JUDGE JEFFERY: Good morning. 

8 MR. SOKOL: Good morning, how are you? 

9 JUDGE JEFFERY: You have 20 minutes, and you can start whenever you 

10 like. 

1 1 MR. SOKOL: That's fine. For the record, my name is Robert Sokol, and I 

12 work with Sterne, Kessler, Goldstein & Fox. 

1 3 The invention here today relates to a mechanism for providing and receiving 

14 multi-media content over a network. The real issue on Appeal comes down 

15 to two items: whether or not authenticating or authorizing are semantically 

16 the same; and, second, whether or not the piece of art that's been cited, 

17 particularly Roy, which is U.S. Patent No. 6785244, teaches authenticating a 

1 8 multi-media device. 

19 In regards to our first argument, which is are authentication and 

20 authorization the same? They clearly are not. 

21 In the security field, those two terms have entirely different meanings as 

22 explained in the Brief. Authentication deals with verifying whether an 

23 entity's identity is true or not. Authorization is just providing access to - for 

24 instance, I'll give you a definition - when an entity is allowed to perform an 

25 activity. 
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1 There were two other definitions in our Brief, but the difference is very 

2 clear. One example might be in a multi-media device, let's say you have a 

3 computer that tries to access a server. 

4 Well, that computer accessing the server may be authorized to access certain 

5 types of files, but that doesn't mean it's authenticated. 

6 It doesn't mean the server has identified that that particular computer is who 

7 it says it is. That's a very important distinction. The piece of art which is 

8 Roy simply does not authenticate. It merely talks about authorization. 

9 There's a fundamental difference between what's being claimed - and we 

10 use the word authenticate in the claim - and what the piece of art says, 

1 1 which is authorize. 

1 2 JUDGE JEFFERY: Didn't the Examiner point out in Column 4 of Roy that 

13 the identity of the user device is sent? What do you think that was for 

14 exactly? 

15 MR. SOKOL: Sure, let me give you an example. Let's say I show up at a 

16 party, and I say my name is Robert Sokol. I'm authorized to enter the party. 

17 My name is on the list. I have not authenticated myself. 

1 8 The authentication happens when I take out my ID from my wallet and show 

19 my driver's license. I'm now authenticated. I have authorization to enter 

20 based on my name. 

21 The same happens in Roy. The fact that identification is sent via a 

22 communication link does not mean that that device has been authenticated. 

23 Authentication happens, for instance, in the art through a digital certificate, 

24 as an example. 

25 We very explicitly describe that in our patent application. So merely 

26 providing an identification is not - is not - authentication. 
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1 I'll give you another example. Let's say - again, this is sort of out of the 

2 context of the application, but still a good example. Let's say you're at 

3 home, and you have multiple computers at your home. You access a server. 

4 Well, you might use the same IP address for all your computers in your 

5 house. The fact that the same IP address is used for multiple devices does 

6 not mean -- it might mean that IP address is authorized to act as the server, 

7 and your home is authorized to act as that server, but you have not 

8 authenticated each of the individual devices. 

9 Now, why does that matter? Well, maybe a specific device within your 

10 home should not have access to a certain file or multi-media clips in this 

1 1 case. Let's say your neighbor comes over to your house with his laptop and 

12 accesses the same network using your IP address. That person may not be 

1 3 allowed access to that file. 

14 So what our invention does is authenticates that the actual multi-media 

15 device that is trying to access the file, or in this case the multi-media clips, is 

16 who it says it is. That is extremely important. You don't want your 

17 neighbor coming over and getting access via the same communication link. 

18 So there's a fundamental difference here: identification and authorization. 

19 JUDGE JEFFERY: To take it a step further, to authorize based on an 

20 identity is not enough for authentication. In other words, what I think I hear 

21 you saying, an authentication is verifying that you are who you say you are. 

22 MR. SOKOL: That's correct. 

23 JUDGE JEFFERY: Versus authorizing based on an identity is just simply 

24 granting access based on a name, ID, whatever you want to call it. 

25 MR. SOKOL: Yes. 
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1 JUDGE JEFFERY: That's different than authenticating by verifying you are 

2 who you say you are. 

3 MR. SOKOL: That's absolutely correct. 

4 JUDGE DANG: Isn't checking the ID to see whether or not you're 

5 authorized, isn't that an authentication? 

6 MR. SOKOL: If, in fact, you check the ID, yes, that would be 

7 authentication. Nothing in Roy suggests that anything is verified. 

8 JUDGE DANG: So the ID goes straight through? 

9 MR. SOKOL: Again, I'll give you an example. Let's say you're making a 

10 telephone call, and your telephone number -- as you know, you have caller 

11 ID at your home. In comes a telephone number that says (301) whatever. 

12 You may realize that person is authorized to call me, but you have not 

13 verified that that person at the other end is, in fact, associated with that 

14 telephone number. Why? Because any device can use another telephone 

15 number. 

16 That's not the key. The key is to authenticate that that telephone is, in fact, 

17 associated with Robert Sokol. That's the key. 

18 How do you do that? Again, in the art there are many ways to authenticate. 

19 One way, for instance, is a certificate as described in our specification. So 

20 there are different ways to authenticate. Merely providing authorization is 

21 not enough. 

22 The second reason that we are patentable over Roy is -- I'll point you to 

23 specific sentences in Roy which I think is relevant here, which is at Column 

24 5, Lines 5 - 8-ish. 

25 It says a multi-media bridge 114 then examines whether the request is valid 
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1 and/or has proper authorization. This is the one piece of Roy that talks about 

2 authorization, as I understand it. 

3 JUDGE BLANKENSHIP: What do you think valid means in this context? 

4 MR. SOKOL: Same as it has authorization. 

5 JUDGE BLANKENSHIP: Well, it says valid and proper authorization. 

6 MR. SOKOL: I can't speculate, really, as to what that means. There's no 

7 reason to believe that's authenticated. There's nothing else in this — 

8 JUDGE BLANKENSHIP: You have no theory what it means? 

9 MR. SOKOL: Give me a moment. 

10 Sure, I can speculate as to what it might be. Let's take the address of an IP 

1 1 address. It might merely be determining that the IP address is, in fact, a 

12 valid IP address, as opposed to one that's made up. 

13 Therefore, it would check perhaps to make sure the IP address is valid. 

14 Then it could also check to make sure that IP address is authorized to access 

15 the - to perform the telephone call in Roy. What Roy is dealing with is a 

16 conference call situation. 

17 So you have an IP address, and it is confirming, A, that's on my list of valid 

18 addresses; and, B, that address is authorized to make this telephone call. 

19 That's all. It has not authenticated. 

20 JUDGE BLANKENSHIP: Well, we know the bridge has the identity of the 

21 user device making the request. 

22 MR. SOKOL: Fair enough. 

23 JUDGE BLANKENSHIP: Didn't you say an ID was authentication? 

24 MR. SOKOL: No, an ID in the sense of - as I understand Roy using the 

25 term ID, it's merely, for instance, the IP address not a certificate that proves 

26 you are who you say you are. 
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1 There's a difference between, again, me providing — I go to a party, and I 

2 say my name is Robert Sokol. I've identified myself. I've not proven — I've 

3 not authenticated myself still. 

4 I take out my driver's license, I've now authenticated myself. There's a 

5 difference. 

6 JUDGE DANG: Didn't you just explain to me, with my example previously, 

7 that if I were to show the ID and it matches, then I can be authorized to 

8 enter? That is authentication. 

9 MR. SOKOL: I did say that, absolutely. 

10 JUDGE DANG: So isn't that making sure whether an ID is valid or not? 

1 1 MR. SOKOL: I guess I'm wondering specifically which text we're talking 

12 about in Roy so I can be more responsive. 

13 JUDGE BLANKENSHIP: Column 4, Line 42. 

14 MR. SOKOL: Okay. 

15 JUDGE BLANKENSHIP: It doesn't say IP address. It says identity of the 

16 user device. 

17 MR. SOKOL: Okay. It's merely providing the identity of the user device. 

18 It's not authentication. That could merely be a name associated with the user 

19 device. Again, it could be the IP address. It could represent a Motorola 

20 telephone. 

21 I don't know what this means beyond the plain identity. What this does not 

22 mean to me is that some type of authentication is being forwarded to the 

23 server so the user device can be authenticated. That step does not mean 

24 authentication to me. 

25 JUDGE DANG: Do you define authentication in your specs? 
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1 MR. SOKOL: Define it? We do not define it in our specification. 

2 Authentication in the security field has a well-known, understood meaning. 

3 We use the plain, ordinary meaning. 

4 Authenticate means verification of an entity's identity; or, as we put in our 

5 Brief, whether someone or something is, in fact, who or what they declare to 

6 be. That is the well understood meaning of authentication. 

7 JUDGE JEFFERY: Let me ask you this, Counsel, going back to 

8 authentication. Let's say I have a system that doesn't go through a number of 

9 steps to verify - to authenticate an identity, but nonetheless assumes that a 

10 received identity is proper or is who they say they are. 

11 In other words, you show me your ID card and I don't go through a lot of 

12 investigative steps to figure out who you say you are kind of thing. I just 

13 take your word for it. Wouldn't that be an authentication? 

14 Just merely assuming that a received identity is who they say they are? 

15 Given the broadest reasonable interpretation of the term? 

16 MR. SOKOL: No. 

17 JUDGE JEFFERY: I have to go further, in other words. I have to do some 

18 sort of investigation, if you will, to determine the identity of that person to 

19 authenticate? 

20 MR. SOKOL: Yes. It is not merely enough just to provide a name or 

21 identity of the device. 

22 JUDGE JEFFERY: Well, my question is, is it enough to provide the name 

23 and identity and then have the receiver assume the correctness of that 

24 information? 

25 MR. SOKOL: It is not enough. 

26 JUDGE JEFFERY: That's not enough, okay. 
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1 MR. SOKOL: It's not enough. That is not authentication as it's known in 

2 the security field. 

3 To come back to my previous argument, again, I put forth the Roy reference 

4 does not teach authenticating the device. It merely says, as was pointed out 

5 in Column 5, the multi-media bridge that examines whether the request is 

6 valid and/or has proper authorization. 

7 The request is what's being determined whether it's valid or the proper 

8 authorization, not the device itself. Therefore, regardless of the distinction 

9 between authorization and identification, I still suggest that Roy doesn't 

10 teach authenticating the device itself. 

1 1 JUDGE BLANKENSHIP: That same section says request of the user 

12 device. It doesn't say request of the human user. 

13 MR. SOKOL: Agreed. The user device - in this case it could be a 

14 telephone is sending a request via electronic signals, and that request is 

15 being determined whether or not it's valid and/or authorized. 

16 Again, the example we talked about earlier, the IP address may be sent over 

17 during a telephone conference. It determines whether or not that IP address 

18 is valid and is authorized to make this kind of phone call. That request is 

19 then determined to be valid and/or authorized. But what is not happening 

20 here is the user device is authenticating. 

21 JUDGE BLANKENSHIP: You said the authentication was based on 

22 standards in the prior art? 

23 MR. SOKOL: I don't dispute that. Authentication — we did not invent 

24 authentication. 

25 JUDGE BLANKENSHIP: But this validation of identity in the reference, 

26 they're not what's in the prior art? 
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1 MR. SOKOL: Excuse me? Repeat that again? 

2 JUDGE BLANKENSHIP: This is somehow different from what other 

3 people are doing in the prior art? 

4 MR. SOKOL: Our invention? The claimed invention? 

5 JUDGE BLANKENSHIP: The authentication of the prior art. 

6 MR. SOKOL: I'm not sure if I'm following you. Are you asking whether or 

7 not the claimed invention uses the term authentication in a way that's 

8 different than what was already in the prior art? 

9 JUDGE BLANKENSHIP: Would one of ordinary skill in the art reading 

10 this decide the identity of the user device is validated? They would say, 

1 1 well, that's not authentication, even though there are standards 

12 in the art for that. 

1 3 MR. SOKOL: I'm personally not one skilled in the art, so it's difficult to 

14 speak to one who is skilled in the art. There's nothing in the record to 

15 suggest that one skilled in the art would interpret this language to be 

16 authentication. 

17 In fact, the Examiner's argument is that authentication and authorization are 

18 semantically the same. We dispute that. They are not semantically the 

19 same. They are well understood in the art to be different. 

20 Does that answer your question? 

21 JUDGE BLANKENSHIP: Yes. 

22 JUDGE DANG: So are you saying that sending an identification and 

23 determining the device is authorized would not suggest authentication? 

24 MR. SOKOL: That is exactly what I'm saying. 

25 JUDGE DANG: Okay. 
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1 JUDGE JEFFERY: Can there be times when you have a self- authenticating 

2 situation where - I'll go back to my earlier example about receiving identity 

3 from something or someone and presuming the correctness of that 

4 submission. In terms of it being self- authenticating, do you have any kind of 

5 situation like that? 

6 I'm thinking like the law of evidence. You know, the Federal Rules of 

7 Evidence deal with authentication of documents for admissibility, that kind 

8 of thing. 

9 I seem to recall back in the day learning about self-authenticating 

10 documents. That you don't have to go further. In other words, you presume 

1 1 that it's authenticated. 

12 MR. SOKOL: I do think we're talking apples and oranges here between 

13 evidence and what documents are assumed to be authentic, and a 

14 telecommunication system where you're trying to authenticate a 

15 telecommunication user device over a network. 

16 JUDGE JEFFERY: Well, I understand the distinction. I bring this up 

17 because the reference actually has the identity being sent and received and 

1 8 used in some way shape or form. 

19 MR. SOKOL: That's correct. 

20 JUDGE JEFFERY: The question is the reference doesn't go further in terms 

21 of explaining how that is used in terms of - at least in your position — 

22 authentication purposes. But it's nonetheless received and used anyway. 

23 So the question is - it seems like it's assuming the correctness of the 

24 received identity. That's what I'm getting at. So I think there is — 

25 MR. SOKOL: Well, I think when you have an assumption of authentication, 

26 you merely have authorization. 
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1 JUDGE JEFFERY: And that's not authentication. 

2 MR. SOKOL: That is not authentication. 

3 JUDGE JEFFERY: That's not self-authentication? If you receive an 

4 identity and you don't question it, you're presuming that's the identity that's 

5 the correct identity. 

6 MR. SOKOL: You have a default as a system that you're not going to check 

7 authenticity. That you're going to merely allow anyone who says they are 

8 who they are to have access to your system. 

9 JUDGE JEFFERY: I understand, and the reason I bring up the Federal 

10 Rules of Evidence on self- authentication, there's certain classes of evidence 

1 1 that there's no need to verify any further. It's presumed to be an authentic 

12 piece of evidence, if you will. 

13 What I'm getting at here is with respect to the receipt of the identity here, 

14 there doesn't seem to be any question that that person - that the identity 

15 that's been received is the correct identity. 

16 MR. SOKOL: I think that's accurate. I think it all depends on the system 

17 you have. Is there a reason, for example, to authenticate within the system. 

18 I would suggest that in the telecommunication system like Roy where you're 

19 merely setting up a multi-party telephone call that there'd be no reason to 

20 authenticate the individual users. 

21 Now, I'm not suggesting it could never happen. Certainly, you might want 

22 to provide a higher level of security to make sure that only people who are 

23 authenticated can participate in your multi-party phone call. 

24 But, generally speaking, someone calls up with the right telephone number 

25 and the right name, they're authorized to make the telephone call, and they 

26 allow it to happen. There's no need to go the extra step. 
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1 What I'm saying in our case is we go an extra step. We authenticate the 

2 multi-media device, and the reason we do so — one of the reasons we do so, 

3 and we put this in our Brief - is you may want to make sure that only that 

4 device can gain access to the multi-media clips on the server. 

5 Even though that device has been authorized, authorization is not enough. 

6 Because you might have someone else come in with another device from the 

7 same IP address and download those clips to their device. You want to stop 

8 that. You want to make sure it's only that device that can gain access to 

9 those multi-media clips. 

10 So it's a higher level security, and I suggest that Roy doesn't teach that. 

11 JUDGE JEFFERY: Any further questions? 

12 JUDGE BLANKENSHIP: No. 

13 JUDGE DANG: No. 

14 JUDGE JEFFERY: Counsel, I think that will be all. Thank you very much. 

15 MR. SOKOL: Thank you for your time. 

16 Therefore, the proceedings at 10:10 a.m. were concluded. 
17 
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